Hello and welcome to the Tuesday, October 18th, 2020 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

So here today wrote up a philess power-shell dropper and now fileless, well, she doesn't mean zero files,

but it minimizes interaction with the file system by actually using registry keys, which

of course is fairly common.

The keys in this case look random, but are always the same for this malware, so makes real nice specific indicators

of compromise if you want to look for it. While the tropper is creating and reading the

register keys, it has pretty low virus total scores. However, it will then install a DLL and that one does have a decent recognition

among the anti-malvary tools in a virus total. But again, that's a little bit of the point here.

The dropper itself is of course the part that's sort of then more consistent and persistent

on the system.

If a particular malware that's being installed by the dropper does have high recognition,

then an attacker could easily swap it out for something else.

And yet again, we have a remote code execution vulnerability in a frequently used Java library.

This time it is Apache Commons text, and version 1.5 through 1.9 is vulnerable.

The library is used to process text strings, essentially, and one of the features is its ability

to interpolate, to basically expand little macro, sort of that you can define it, and

one of these interpolations is a URL that will then write a file to the file system that is loaded from that URL.

Proof of concept exploit has already been published and it's actually a real straightforward vulnerability because it just uses a particular feature, not necessarily

sort of an exploit per se. However, how much this affects a particular application really

depends. And people already have compared this to Log 4J. Somewhat true, I think, because

it is a very popular Java library, but really depends on how you're using this library and how, which features actually are using.

...